Privacy & Data Protection Policy

INTENTIQ Limited (“INTENTIQ”, “we”, “us”) is a company incorporated in England and Wales. We develop and operate INTENTIQ™ — a cloud-based clinic management platform purpose-built for aesthetic medicine, advanced wellness, and longevity practices in the United Kingdom.

Our registered office address and company details are:

This policy applies to:

• Clinic clients — clinics, practitioners, and practice managers who subscribe to the INTENTIQ™ platform
• Website visitors — anyone visiting www.intentiq.co.uk
• End patients — patients whose data is held within the INTENTIQ™ platform by a subscribing clinic

2.1 From Clinic Subscribers (Business Contacts)

• Name, job title, clinic name, and business address
• Business email address and telephone number
• Billing and payment details (processed via a PCI-DSS compliant payment provider — we do not store card numbers)
• Platform usage data, login activity, and audit logs
• Communications with our support team

2.2 From Website Visitors

• Contact form submissions (name, email, clinic name, message)
• Cookie and analytics data (see Section 12)
• IP address and browser/device metadata

2.3 Patient Data Held Within the Platform

• Full name, date of birth, contact details, and address
• Medical history, allergies, and current medications
• Treatment records, clinical notes, and procedure records
• Injectable product batch numbers and traceability records
• Consent forms and digital signatures
• Appointment history and scheduling information
• Before-and-after photographs (where uploaded by the clinic)
• Prescription records
• Safeguarding and incident records
• Patient feedback and satisfaction data

3.1 Clinic Subscriber Data

3.2 Website Visitor Data

• To respond to enquiries submitted via contact forms
• To analyse website traffic and improve content (via anonymised analytics)
• To send requested resources, such as compliance guides or brochures

3.3 Patient Data (Processing on Behalf of Clinics)

We process patient data strictly in accordance with the instructions of the subscribing clinic (the data controller). We do not use patient data for our own purposes, do not sell it, and do not share it with third parties except where required to operate the platform or where legally required.

Under UK GDPR Article 6, we rely on the following lawful bases:

5.1 INTENTIQ’s Role

INTENTIQ processes special category health data solely as a data processor on behalf of subscribing clinics. We do not determine the purpose or means of processing this data — that responsibility rests with the clinic as data controller.

5.2 Clinic Obligations

Subscribing clinics, as data controllers for patient health data, must ensure they:

• Have identified an appropriate Article 9 condition for processing health data — typically Article 9(2)(h) (health or social care provision) supported by DPA 2018 Schedule 1, Condition 2
• Maintain an appropriate policy document as required by DPA 2018 Schedule 1, paragraphs 5 and 38–41
• Have completed a Data Protection Impact Assessment (DPIA) where processing is high risk
• Provide patients with a clear privacy notice explaining how their health data is used
• Retain health records for a minimum of 8 years (or until age 25 for minors) in line with NHS/MHRA retention guidance

5.3 Before-and-After Photographs

Before-and-after photographs are classified as special category data under UK GDPR as they may reveal physical characteristics and health conditions. Clinics must ensure they have obtained explicit, specific, and informed consent for each intended use separately. INTENTIQ does not share or use clinical photographs for any purpose other than platform storage on behalf of the clinic.

Where INTENTIQ acts as a data processor, we:

• Only process patient data on the documented instructions of the clinic
• Do not use patient data for any independent purpose
• Maintain appropriate technical and organisational security measures
• Assist clinics in responding to data subject rights requests where technically feasible
• Notify clinics without undue delay in the event of a data breach
• Delete or return patient data at the end of the contract, subject to legal retention obligations

A formal Data Processing Agreement (DPA) is included within or available alongside the INTENTIQ™ subscription agreement, as required by UK GDPR Article 28.

We do not sell personal data. We share data only in the following circumstances:

7.1 Sub-Processors (Platform Operation)

A full list of sub-processors is available on request by emailing info@intentiq.co.uk.

7.2 Legal Requirements

We may disclose data where required by law, regulation, or a court order — for example, in response to a request from the Information Commissioner’s Office (ICO), HMRC, or law enforcement. We will notify you where legally permitted to do so.

7.3 Business Transfers

In the event of a merger, acquisition, or sale of all or part of our business, subscriber data may be transferred to the acquiring entity. We will notify affected subscribers in advance of any such transfer.

We primarily store and process data within the United Kingdom and the European Economic Area (EEA). Where any data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place, including:

• UK Adequacy Regulations — transfers to countries recognised as providing adequate protection by the UK government
• UK International Data Transfer Agreements (IDTAs) — where no adequacy decision exists, we use legally approved transfer mechanisms
• Binding Corporate Rules — where applicable for sub-processor groups

Details of any international transfers and the safeguards applied are available on request.

On termination of a clinic subscription, patient data held within the platform is retained for 30 days to allow data export. After this period, data is permanently deleted from live systems.

We implement industry-standard technical and organisational measures to protect personal data against unauthorised access, loss, alteration, or disclosure. These include:

Under UK GDPR, you have the following rights in relation to your personal data where INTENTIQ is the data controller. We will respond to all requests within 30 days.

The INTENTIQ™ website (www.intentiq.co.uk) uses cookies to improve your browsing experience and analyse website traffic. We use the following categories of cookies:

You can manage your cookie preferences at any time via our cookie banner or by adjusting your browser settings.

We review this Privacy & Data Protection Policy at least annually, and following any significant changes to our platform, applicable legislation, or ICO guidance. Material changes will be communicated to subscribing clinics by email at least 14 days before they take effect.

Previous versions of this policy are available on request.

For any questions about this policy, to exercise your rights, or to raise a concern, please contact us:

Complaints to the ICO

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) — the UK’s independent data protection regulator:

We would always appreciate the opportunity to resolve any concerns directly before you contact the ICO, so please reach out to us first.